A threat group has successfully been exploiting a two-year-old vulnerability in SonicWall SSL-VPN appliances since February, despite the flaw being patched, according to a report released Tuesday by cybersecurity firm Reliaquest.
The authentication bypass vulnerability, tracked as CVE-2024-12802, allows an attacker to bypass multifactor authentication (MFA) in SonicWall SSL-VPN appliances.
Starting in February 2026, attackers were able to engage in brute force attacks using automated tools, which bypassed MFA without setting off any red flags or login alerts, according to Reliaquest researchers.
After encountering the same pattern across multiple incident response scenarios, Reliaquest began investigating the activity.
“Across those cases, all between February and March 2026, we saw the same pattern: VPN accounts brute-forced at speed, MFA appearing enabled but not stopping authentication, and a specific session type in the logs pointing to automated tooling,” Reliaquest researchers told Cybersecurity Dive.
Researchers could not provide direct attribution for the attacks, but the threat activity was consistent with ransomware activity from the Akira group. That group was linked to a series of attacks targeting SonicWall customers in 2025.
SonicWall issued an advisory and a firmware upgrade in 2025, but Reliaquest warned that there are six additional manual steps required to make sure Gen6 devices are secure. The patches are working normally in Gen7 devices, researchers said.
The attacks are accomplished by exploiting the separate handling of User Principal Name and Security Account Manager account names when integrated with Microsoft Active Directory. The firmware update by itself fails to remove the Lightweight Directory Access Protocol configuration, which enables the bypass.
Researchers said the flaw was given a severity score of only 6.5 by SonicWall, which may have led some organizations to not pay close attention. CISA’s Authorized Data Publisher assessment rates the vulnerability as a 9.1, which is considered critical.
In a more recent development, Gen6 appliances reached end-of-life status on April 16, which means SonicWall no longer supports them.
A spokesperson for SonicWall was not immediately available for comment.
